As crises grow in frequency and complexity, Dr. Paul Wood believes organisations and society need a recognised profession of crisis resilience focusing specifically on the human capabilities that determine how well organisations perform when crises strike.
A gap in the profession?
When a crisis strikes, who in your organisation is responsible for ensuring that your people can cope? Not the process. Not the technology. The people. In most organisations, the honest answer is that nobody holds that specific responsibility. Crisis preparedness is spread thinly across risk registers, business continuity plans and emergency procedures, yet the human dimension, the capability of individuals and teams to actually perform under the acute pressures of a crisis, is rarely owned by anyone.
This is a significant gap in my view. Research consistently demonstrates that the decisive factor in crisis outcomes is not the quality of an organisation’s plans but the capability of the people who must execute them. Decision-making under uncertainty, communication in high-pressure environments, leadership when the situation is ambiguous and evolving: these are human capabilities that determine whether an organisation navigates a crisis effectively or is overwhelmed by it. The Grenfell Tower disaster revealed failures not of procedure but of human judgement, communication and leadership at critical moments. The 2017 WannaCry attack on the NHS exposed organisations that had invested in technical defences but neglected to prepare their people for the reality of operating under sustained crisis pressure. In each case, the decisive failures were human, not technical.
Of course, there are long-established and highly developed professional disciplines in adjacent fields. Risk management has ISO 31000 and the Institute of Risk Management. Business continuity has ISO 22301 and the Business Continuity Institute. Emergency planning, disaster management and crisis management each have their own mature standards, training programmes and professional qualifications. These disciplines are essential, and the expertise they have built over decades provides a critical foundation for organisational preparedness. Each makes a vital contribution to ensuring that organisations have the structures, processes and plans in place to deal with disruption.
Yet there is no established professional discipline for crisis resilience: the capacity of people and organisations to withstand, respond to and recover from acute crises. It sits across and beneath the established disciplines, drawing upon all of them, but addressing something none of them fully owns: the integrated human capability that enables everything else to work when it matters most. I believe it is time to change that. Organisations and society need a recognised profession of crisis resilience, with practitioners who possess a defined body of knowledge, a structured development pathway and the credibility to lead this critical area of organisational capability.
The decisive factor in crisis outcomes is not the quality of an organisation’s plans but the capability of the people who must execute them.
What Is Crisis Resilience?
Crisis resilience is distinct from both organisational resilience and crisis management, though closely related to each. Organisational resilience describes the broad capacity of an organisation to anticipate, prepare for, respond to and adapt to change. Crisis management refers to the procedural and structural arrangements for managing crisis events. Crisis resilience sits between and beneath these concepts. It is fundamentally concerned with the human capabilities that enable effective performance during periods of acute crisis: the individual and collective qualities of a workforce that determine how well an organisation actually performs when it matters most.
These capabilities do not develop by accident. They must be deliberately identified, cultivated, measured and sustained over time. Research has identified at least twelve distinct human factors that contribute to crisis resilience: personal resilience, flexibility, communication, motivation, decision-making, perseverance, sense-making, optimism, leadership, risk awareness, self-efficacy and perception. Critically, these factors do not operate independently.
They form a mutually reinforcing architecture: strong communication supports better sense-making, which improves decision-making, which in turn strengthens leadership effectiveness during a crisis. An organisation’s crisis resilience depends upon how well this architecture is developed across its workforce.
Six core capability areas
If crisis resilience is to become a recognised profession, or skillset for those with responsibility for it, alongside their other role, then its practitioners need a defined body of knowledge. Based on current research and professional practice, six core capability areas can be identified that a crisis resilience professional must develop.
Intelligence
Practitioners must gather, assess and interpret information from multiple sources to identify emerging threats before they escalate. This requires fluency in intelligence methodologies, open-source research and threat assessment. Critically, they must understand how cognitive biases distort threat assessments and develop the analytical discipline to challenge assumptions when incomplete information must inform urgent decisions.
Risk
Practitioners must move beyond probability-impact matrices to consider systemic risks, cascading failures and the human factors that shape how risks are perceived and acted upon. The ability to translate risk analysis into preparedness measures that genuinely change behaviour is what separates effective practice from compliance-driven box-ticking.
Converged security
The boundaries between physical, cyber, personnel, information, technical and people security have become increasingly blurred. A crisis resilience professional must understand how threats exploit gaps between these domains and how a converged approach strengthens crisis prevention and response. This demands breadth across security disciplines and the ability to think in interconnected systems rather than isolated silos.
Security culture
Technical measures and procedural controls are only as effective as the culture that supports them. Practitioners must know how to build, assess and sustain a positive security culture, influencing attitudes and behaviours at every level so that security awareness is embedded in daily practice rather than confined to annual training sessions.
Resilience and business continuity
A deep understanding of resilience theory and business continuity practice provides the foundation for programmes that develop human crisis capabilities. This includes knowledge of how resilience can be built through structured testing, training, measurement and sustainment, recognising that crisis resilience is a dynamic capability requiring continuous renewal through organisational routines, not a one-off investment.
Communication and leadership
Perhaps the most critical capabilities of all. During a crisis, the ability to communicate clearly under pressure, lead teams through ambiguity and maintain stakeholder confidence can determine whether an organisation survives intact. Practitioners must develop these abilities to an advanced level and be equipped to develop them in others across the organisation.
Crisis resilience is not a static quality but a dynamic capability requiring continuous renewal through organisational routines.
Why professionalisation matters
Other areas of security and risk practice benefit from established professional frameworks. Physical security, cyber security, business continuity and risk management each have recognised professional bodies, qualifications and career pathways. Crisis resilience has none of these. It draws upon and complements all of these established disciplines, but there is not an equivalent professional infrastructure dedicated specifically to the human dimension of crisis performance. The consequence is that responsibility for developing human crisis capabilities falls to people who may have expertise in one adjacent discipline but lack the breadth of knowledge required to address the challenge holistically.
The business case is clear: organisations with mature crisis capability reduce recovery time, protect reputation and retain stakeholder trust when disruption strikes. When crisis resilience responsibilities are distributed across existing roles without a unifying professional framework, organisations lack a coherent approach to developing human crisis capabilities. Individual departments may invest in training that addresses their own narrow concerns without reference to the broader capability architecture that determines how well the organisation performs as a whole. A crisis resilience professional provides the integrating function that connects these efforts into a coherent strategy.
The societal imperative
Every organisation that develops genuine crisis resilience capability within its workforce contributes to the resilience of the broader society it serves.
Recent experience has made this abundantly clear. The Covid-19 pandemic exposed the fragility of organisations that had invested in plans and procedures but neglected to develop the human capabilities needed to execute them under sustained pressure.
By contrast, logistics firms that had cross-trained their teams in crisis decision-making and adaptive leadership maintained operations throughout the pandemic, demonstrating that investing in human crisis capability delivers measurable operational advantage. The lesson is consistent: resilience is ultimately a human quality and it must be developed with the same rigour and professionalism that we apply to any other critical organisational capability.
A call to action
The security profession has evolved considerably over recent decades, with specialist disciplines emerging in response to new threats and challenges. Crisis resilience represents the next necessary evolution. It builds upon these established disciplines by focusing specifically on the human capabilities that determine how well organisations actually perform when crises strike. The knowledge exists. Much of it already resides within these established fields. I believe the need is clear. What is missing is the professional infrastructure to bring them together: defined competency frameworks, recognised qualifications, structured career pathways and a community of practice committed to advancing the discipline.
It is my view that employers should recognise crisis resilience as a distinct function and invest in developing dedicated practitioners rather than distributing this critical responsibility across already stretched roles.
Professional bodies such as the BCI, IRM, Security Institute and others should consider how their existing frameworks can accommodate and promote crisis resilience as a specialism. Universities and training providers should develop programmes that equip practitioners with the breadth and depth of knowledge the role demands, building upon qualifications in related fields and adding the integrative human capability focus that distinguishes crisis resilience as a specialism.
The people who will lead organisations through the next crisis deserve nothing less. And the communities that depend upon those organisations deserve professionals who are specifically equipped to protect them. The profession will emerge, because the need demands it. The only question is whether we build it deliberately now or learn the hard way that we should have done so sooner.
Dr. Paul Wood MBA CSyP ChCSP CiiSCM CIISec FSyl RSES (Principal)
CEO, Emerging Risks Global
